Tap Notes: What the Spec Assumed

Every item in today’s stack is the same failure mode wearing a different costume: a spec, a guardrail, or a mental model that was correct for the world it was designed in, and nobody re-checked the assumption before more weight got stacked on top. A protocol built for two humans talking gets handed a GPU generating audio faster than real time. A “timeout” gets treated as a verdict instead of a checkpoint. A safety toggle that only matters in one specific unsafe configuration gets flipped off because it was slowing things down. Pull the thread on any of these and it’s the same rope.

A quote from Thibault Sottiaux Simon Willison flags a reproducible Codex bug: run it in full-access mode with sandboxing and auto-review both off, and it can delete files it had no business touching.

Why it matters: the bug isn’t a hallucination — it’s an environmental config, which is worse, because it means the failure is fully repeatable and entirely on you to avoid. If you run any coding agent with elevated file access, this is the specific combination to never assemble: full access and no sandbox and no review. Guardrails aren’t friction to route around when you’re in a hurry — they’re the thing standing between “agent did something dumb” and “agent did something dumb to files you can’t get back.”

Full-access mode + no sandboxing + no auto-review is a repeatable way to delete your own files with Codex.

Post to X

arda tasci An agent-harness design piece built around one principle: the model’s existing knowledge of files, directories, and Unix tools is the cheapest resource you have, so build the harness to use it instead of inventing a new interface for the model to learn.

Why it matters: if you’re building agent tooling and reach for the heartbeat-polling pattern — check every N seconds, waste tokens on empty checks or miss events on a slow interval — this is the alternative worth stealing. An event-driven kernel with filesystem cursors turns “did anything happen” from a question the model has to keep asking into something it can just read off disk. Less clever interface, more actual responsiveness.

Three Bugs, One Shape: When a Timeout Isn’t a Failure Three separate incidents in one week, all sharing the same root cause: something that looked like a failure was actually just a state that hadn’t reported back yet.

Why it matters: “the deadline isn’t a verdict, it’s a checkpoint” is a genuinely useful reframe for anyone running distributed or async work — a task that hasn’t finished isn’t the same as a task that failed, and treating them the same way is how you end up debugging the wrong layer for hours. The other lesson worth stealing is the method: the author caught the pattern through a nightly reflection loop, not by staring at one incident harder. Three bugs looked unrelated until someone asked “have I seen this shape before?”

OpenAI’s WebRTC Problem - Media over QUIC A breakdown of why WebRTC — designed for two humans on a live call — breaks down once one side of the connection is a model generating audio faster than real time.

Why it matters: the detail that sells the whole argument is Discord’s fallback for ssrc collisions — when two clients randomly pick the same session ID, the server just brute-force-decrypts the packet with every candidate key until one works. That’s not a patch, that’s a symptom. WebRTC assumes symmetric, live, human-paced production on both ends, and the instant you put a GPU on one side that wants to buffer two seconds of compute into eight seconds of audio, every assumption in the spec inverts. If you’re bolting voice onto an AI product: reach for QUIC or WebTransport if latency actually matters, plain WebSockets if it doesn’t, and don’t reach for WebRTC just because it’s the “real” way to do audio. It was built for a different shape of conversation than the one you’re having.

Discord’s fix for ssrc collisions: brute-force-decrypt the packet with every candidate key until one works.

Post to X

The future isn’t what it used to be A response to Noah Smith’s essay on AI-driven uncertainty about the future — and a pushback on the idea that listing four or five scenarios (utopia, chaos, superintelligence-as-pet-owner) counts as epistemic humility.

Why it matters: bounding your unknowns to a known scenario menu is confident extrapolation with extra branches, not the unknown-unknowns it claims to be. The sharper point underneath: there are two different kinds of not-knowing here. Whether AI transforms the labor market at all is trackable — you watch capability curves and deployment data and it resolves over time. How institutions, unions, and firms actually respond is adversarial and path-dependent — more data doesn’t collapse that kind of uncertainty the way it collapses the first kind. Collapsing both into one “fog” metaphor reads well and produces a mushier action plan than treating them separately would.

One more thing worth sitting with: “they just didn’t know they were wrong yet” is the rhetorically strongest line in Smith’s essay precisely because it’s unfalsifiable in real time. It has the exact shape of every bubble-caller’s and every doomsday preacher’s argument — the only thing separating wisdom from paranoia is being right in hindsight, which you can’t check from inside the moment you’re in.

🪨